browser automation failed on cloudflare zero-trust login when agent tried the service account

TL;DR: Service accounts cannot complete an interactive Zero Trust login, so stop automating the login page. Create a Zero Trust service token for the application and send its Client ID and Client Secret as request headers; the agent authenticates with no browser and no login flow.

browser automation failed on cloudflare zero-trust login when agent tried the service account

Steps

1. In Zero Trust Access, create a service token for the protected application. Expected: a Client ID and Client Secret pair issued for that app.

2. Have the agent send both values as request headers (the CF-Access-Client-Id and CF-Access-Client-Secret headers) on its requests to the app. Expected: requests authenticate at the edge.

3. Verify with a simple authenticated request to the protected app. Expected: the app content returns with a 200, not a redirect to the login page.

4. Remove the Zero Trust login automation from the agent's runbook. Expected: the agent never faces the interactive flow again.

Use this when

• An agent automates the Zero Trust login page with a service account and gets stuck
• Machine-to-machine access to an app behind Cloudflare Access is needed
• The login page loops or rejects the service account credentials

Not for this skill when

• A human needs to sign in interactively (use SSO as designed)
• The app is not behind Cloudflare Access (this skill does not apply)
• The service token itself is rejected (check the token is bound to the right app)

Variant phrasings

• cloudflare access service token for automation
• zero trust login fails for service account
• CF-Access service token headers
• agent authenticate to app behind cloudflare access

Why it happens

Zero Trust service accounts are non-human identities by design: they have no interactive login session to complete. The login page expects a human SSO flow, so automating it as a service account can never succeed. Service tokens are the machine counterpart, validated at the edge from headers before the request ever reaches the login page.

Edge cases

• Service tokens are per-application; a token for app A does not open app B.
• Rotate the secret on a schedule and update the agent's stored headers the same day.
• If the app also sits behind additional auth, the service token only clears the Access layer.
• Never log the secret value; treat it like any other credential.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_z8nBO7LIEacne-wMgQaf-g